Web client perf: remaining open areas after the web-client fixes branch #1562

Follow-up to branch ade/web-client-fixes-and-perf-9ec98328. That branch fixed the transcript gap at web zoom, secret redaction in command lines, the Clone locally pill, the plain default scene, the boot payload (−84% transfer on a cold signed-out load), and relay poller pacing.

The benchmark is npm run bench:webclient in apps/desktop. It runs CDP headless Chrome and supports an interleaved A/B (--root / --compare).

Open perf areas (web client)

1. Render-blocking entry CSS is 659 KB. It is the largest remaining cost before the sign-in screen paints. Idea: split the stylesheet per route or chunk, or ship critical CSS for the gate.
2. appStore (249 KB) is still in the signed-out graph. WebSignInGate needs theme and preferences, which live in the app store. Fix: split the preferences into a small store the gate can import without pulling in appStore.
3. AgentChatPane renders about twice per streamed event. Commits are 2.2 per event. About 460 renders per stream change no pane state. Parent: SessionSurface (renderer/components/work/WorkViewArea.tsx ~823). Next step: probe prop identities of SessionSurface and SingleSessionGridDropZone per render.
4. Subagent card callbacks are unstable. New closures each render defeat memo on the subagent cards.
5. deriveActiveTurnId scans every event each update. Make it incremental, the way deriveChatSubagentSnapshotsIncremental is.
6. The mergeAgentChatLiveEvents identity Set is rebuilt each merge. Make it incremental.
7. A long chat renders its whole history on open. That is ~0.7 s idle and up to ~7 s under load (scripts/perf-chat-stream.mjs openToFirstRowsMs). Windowing on open is high risk because of measurement and stick-to-bottom wiring in AgentChatMessageList.tsx.
8. Not measured: the hosted client signed in to a real machine over ADE Relay. The bench cannot sign in. Add an authenticated bench path or a relay-replay fixture.

Found, not fixed (outside the web client)

• iOS shows raw commands, including secrets. These sites have the same leak the desktop and web working line had: WorkActivityIndicator.swift:383 (summarizeCommand), WorkStatusAndFormattingHelpers.swift:427, WorkStatusAndFormattingHelpers.swift:1773. Port redactCommandLine (apps/desktop/src/shared/secretRedaction.ts) to Swift and apply it before truncation.
• Two brains on one project DB. A dev brain started from another lane with the shared ~/.ade (/tmp/ade-runtime-slow.sock) claimed chats from the installed brain. That produced false idle notices and duplicate subagent runs. Dev brains should never share the installed brain's DB.

Numbers from the fixes branch (5-run interleaved A/B, cold signed-out load)

PR: #1561